Google Workspace

Overview

The Google Workspace app collects Google Workspace audit logs (admin activity, login, Drive, Gmail, Meet, Chat, OAuth token) and Alert Center alerts, and provides query commands to look up domains, users, groups, and Drive connected apps, and to read and write Google Sheets.

Setup Flow

First, decide which loggers and query commands you will use in 1. Required Permissions, and prepare only the permissions they need. Choose an authentication method in 3. Choosing an Authentication Method.

The steps depend on the authentication method. In the table below, follow in order only the steps marked Required for the method you chose. Click a task name to go to its setup page.

Gmail Log Limitations

Gmail logs have the following limitations due to what Google provides.

• Gmail logs may not be available depending on your Google Workspace edition.
• Google keeps Gmail logs for 180 days, so the logger's Scan Days is up to 180 days.
• The google-workspace-gmail-logs query command requires the from or duration option, and queries up to 30 days at a time within the last 180 days.
• The sender address, attachment names and URLs of clicked links are not provided.
• Recipients do not distinguish To, Cc and Bcc.
• Bounces are recorded with mail event type UNKNOWN and action type BOUNCED, and forwarding as FIRST_REPLIED on the original mail.
• Marking as read, downloading a mail, and blocking the sender when reporting spam are not recorded.
• Delivery stage events (UNKNOWN) make up about half of all events.

Network Requirements

Sonar must be allowed outbound HTTPS (443) access to the addresses for the features you use.